c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc

Analysis

max time kernel
7s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 16:57

Target

c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc.exe
Size

95KB
MD5

82cda6799faac51cf4da7cda88923a1b
SHA1

8f12cf06136deaf8b50292bd8d25d76e00da0682
SHA256

c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc
SHA512

240f5cd587f33358816b763662f2df2755ac754c995f5de9076d1ca749e0acda88dd7c514c2801f012aa55ad3f1bc232c0a95fab675268ded232d03ff71566d7
SSDEEP

1536:8wfUj8g+4OXgjNa844zf00QQrF9BUz7DdsMUrmtXJ0at8AmlVcc4IEvDkGzgn:8T8gIsrNA4rF9mjdsMvtX6at8rZ6l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1388	1012	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 1388	1012	c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc.exe	28
PID 1012 wrote to memory of 1388	1012	c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc.exe	28
PID 1012 wrote to memory of 1388	1012	c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc.exe	28
PID 1012 wrote to memory of 1388	1012	c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc.exe	28

C:\Users\Admin\AppData\Local\Temp\c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc.exe
"C:\Users\Admin\AppData\Local\Temp\c62675034dd3e82172af129521282099cf3f70f6bf19fe0e0ecc951a89cf58cc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 128
  2⤵
  - Program crash
  PID:1388

memory/1012-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1012-55-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1012-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1012-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1012-59-0x0000000000260000-0x0000000000273000-memory.dmp

Filesize
76KB

Download
memory/1388-57-0x0000000000000000-mapping.dmp

Download